Privacy Notice Effective Date: January 1, 2020 Demandbase, Inc. and its subsidiary, Demandbase Ltd. (collectively, “Demandbase”, “we” or “us”) provides real-time B2B marketing, advertising, and personalization services through its technology (the “Demandbase Technology”) in addition to a software as a service platform for customers (the “ABM Platform”) and information collected through its partner portal. Demandbase provides its customers with insights and data on companies and information about business clients and prospects in addition to various services that use that data. This privacy policy describes how we handle the information that you supply to us directly and through the Demandbase Technology; the Demandbase ABM Platform; the www.demandbase.com website and our affiliated website, www.abmleadershipalliance.com (“Demandbase Sites”); Demandbase’s collection and use of data obtained through third-party websites that utilize Demandbase Technology, such as beacons or cookies (“Partner Sites”), including the data received through third-party publisher sites through our advertising services. This privacy policy does not apply to data collection and use by Partner Sites, including customers of Demandbase, or any third parties, such as publishers that display ads served by Demandbase. For details on a particular Partner Site or third-party site and its data collection, please visit such website’s privacy policy. 1. DATA COLLECTION BY DEMANDBASE a. Automatic Data Collection Demandbase Sites. Demandbase collects data from you automatically when you visit Demandbase Sites through the use of web beacons and cookies. We automatically receive data from your browser, including the Tag Data (described below) in addition to other data we use to manage and optimize our website. For more details on the cookies we use, visit our Cookie Policy. For customers with access to the Demandbase ABM Platform, we collect transactional information about usage, such as authentication, analytics, and other information to provide the ABM Platform. Demandbase also deploys its own technology on Demandbase Sites, which may enable it to provide you with a more personalized experience when you visit Demandbase Sites. Demandbase Technology and Partner Sites. When Demandbase technology is deployed on a Partner Site, the Demandbase ABM Platform automatically receives data from the Partner Site through the use of web beacons, and in certain configurations, through the use of tracking pixels and cookies (“Tag Data”). For Partner Sites, we automatically collect Tag Data from your browser. Some of the Tag Data collected may be considered personal data in your jurisdiction, such as IP address and online identifiers (cookies) and some may be considered non-personal information, such as browser version, operating system, pages viewed from a site where Demandbase Technology is deployed, and timestamps. Demandbase Advertising Solutions. For its advertising solutions, Demandbase automatically receives data from its publisher and supply partners when it decides on whether to provide an ad to an end-user. Some of the information Demandbase receives may be considered personal information in your jurisdiction, such as online identifiers, location, and IP address and some may be considered non-personal information, such as browser version, operating system, pages viewed, and timestamps. In some cases or in specific jurisdictions, the Demandbase Sites, Partner Sites, or other third-party sites on which we display ads may only permit the Demandbase Technology to receive data from you after you provide consent to cookies or the use of Demandbase Technology. b. Information You Supply to Us Through the Demandbase Site, including Demandbase sponsored marketing and promotions, you may be able to provide contact information, billing information, ask questions, register, or provide other information, some of which may be considered personal data that directly or indirectly identifies you, such as your name, email address, and contact details. We may also offer interactive functionality, such as forms or chat, that enable us or a third party service provider to collect data or interact with you. Through the Demandbase ABM Platform, in certain configurations, customers may be able to provide additional data, including their authorized users’ and clients’ contact information. Demandbase uses this information only to provide customers with services and as otherwise agreed to in their respective agreements. Demandbase may derive insights from usage of these features and types of insight typically derived from customer usage and customer-provided data, but does not use any customer-provided data except to provide its services. Demandbase’s use of information received and transferred via Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements documented at: https://developers.google.com/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes. If your account on the Demandbase ABM Platform is managed by an administrator, that account administrator may have control with regards to how your account information is retained and deleted. Administrators are able to request the deactivation of an account made for you through your company. Through the Demandbase partner portal (available to select Demandbase partners), partners may provide their own and their authorized users’ and clients’ contact information. These partners may also provide demographic information and use the partner portal to conduct outreach. The provision of information is sometimes required by law and at other times is a result of a contractual requirement. You may be required to provide information, for example in a case where we sign a contract with you, and the non-provision of information could, in certain circumstances, prevent a transaction from concluding. c. Data Collected from Other Sources We may receive data about you from sources other than from Demandbase Sites, such as third-party partners, email campaigns, public sources, and marketing partners. Such third-party data may include demographic information, company information, and personal data such as contact details. We may also generate or receive predicted data about business users such as characteristics, interests, or business buying behavior. d. Technology We Use For automatic data collection, Demandbase uses tracking pixels, web beacons, and cookies to collect information. Demandbase may use these technologies either alone or in conjunction with each other. Tracking pixels are small javascript graphic images utilized to track a user, typically for advertising or analytics purposes, including third-party pixels for tracking the effectiveness of email campaigns. Web beacons, often used synonymously with tracking pixels, include javascript (or other programming languages) that allow data to be exchanged between systems, typically through the use of APIs (Application Programming Interfaces). Cookies are small text files that your browser stores on your computer hard drive that enable a site to remember you or your preferences; cookies cannot access, read, or modify any other data on a computer. Through your browser settings, you may be able to manage your cookie settings. Demandbase uses cookies for advertising and analytics purposes, such as to identify returning business visitors and show them customized content, for more details, refer to the Demandbase Cookie Policy. 2. DATA USE BY DEMANDBASE AND LEGAL BASES FOR PROCESSING DATA FOR THE EEA a. Data Use by Demandbase Demandbase uses data in the following ways: For providing and improving its services. Demandbase uses data, including the Tag Data in most situations, to operate, improve, and personalize its business and services, including the Demandbase ABM Platform and the Demandbase Sites. This use includes deriving insights, trends, use, and analytics, whether actual or predicted, from the data collected. Demandbase may also work with third parties to receive data or insights and combine that information with the data and insights provided by Demandbase. When providing our services, Demandbase often uses the data it collects with other data in our possession (such as actual or predicted demographic, location, or publicly available information) or customer-provided data as part of our services. For example, Demandbase may use information to provide customers with support or improve accuracy and develop new features based on historical use and trends. Advertising and Marketing for itself and customers. Demandbase also uses the data it collects for advertising and marketing, such as analyzing and predicting business buying behavior or business interests and delivering interest-based advertising and content to your device, such as ads, widgets, or website content tailored to you on behalf of advertisers, across websites, devices, and over time. When collecting contact details like email address, such as through marketing offers, Demandbase uses the data to communicate with you about offers, events, services, or products by us and partners. Demandbase may also use the Tag Data for such purposes. Demandbase may combine the information it has with third-party data, including data that may directly or indirectly identify you, for improving the personalization of ads. As required by applicable law, legal process, or regulation. Demandbase may use all data it collects or receives as required under law, legal or financial processes like audits, or regulations. To Provide Reporting. Using the Tag Data combined with additional data in its possession, Demandbase may create reports (such as performance analytics, statistics, metrics, and other details) for Demandbase customers on the companies that visit their websites as well as actual or predicted interests for those visitors. Demandbase may also use the Tag Data collected to carry out actions requested by our customers, such as combining data with additional data in our possession or provided by customers or using data to retarget specific companies’ users with personalized advertising. For running its business. Demandbase uses the information it collects for billing, account management, invoicing, investigating security and privacy incidents, as well as other legitimate business interests. Where we intend to process your personal data for a purpose other than the purpose for which it was collected, we will provide you with information regarding the purpose for the processing, as well as other relevant information, prior to processing your personal data for the new purpose. b. EU Legal Bases for Processing Data Depending on the circumstances, Demandbase will use different legal bases to process personal data. For example, in some jurisdictions, when a user explicitly consents, then Demandbase may place cookies on the user’s machine. In other circumstances, Demandbase processes personal data to fulfill a contract (such as managing its customers), when required to do so by law, or if necessary to protect your interests or the interests of a third party. Demandbase may also process data when it’s in Demandbase’s legitimate interests. Demandbase will only use the legitimate interests basis to process data in the event that such interests are not overridden by the fundamental rights and freedoms of individuals. A few examples of these legitimate interests may be to provide its services, process data, conduct direct marketing, and maintain security. c. Retention Demandbase may retain data collected through its services for customers as follows: In logs used for troubleshooting, reporting, and for providing its services, for up to 13 months; For CRM data synched within the Demandbase ABM Platform, Demandbase stores the data for 30 days after the contract period end unless a customer requests an earlier deletion; For other business purposes (like technical developments) for a period necessary to achieve the purpose of the storage and as permitted by law. After this, Demandbase may either aggregate, anonymize or pseudonymize data it collects, such as the Tag Data, so that it is no longer reasonably associated with an identified or identifiable natural person and use it for any business purpose. However, Demandbase may retain this information in a form where it is reasonably associated with an identified or identifiable natural person for longer periods of time when required under law. 3. DATA SHARING BY DEMANDBASE a. Demandbase shares information with third parties for the following purposes: With customers and partners. For example, Demandbase shares information to provide the Demandbase ABM Platform, its services, or technology. Demandbase also shares information, including information derived from the Tag Data, for marketing, advertising, and engagement with their customers, such as market research, providing interest-based advertising (including retargeting or remarketing), analytics, and advertising and marketing optimization. A customer may choose to link the Tag Data from their own website with additional personal data in their possession. Customers may also take actions within the Demandbase ABM Platform and elect to have insights and data shared with third party integrations. Improving Ad Personalization. Demandbase may share Tag Data (specific to a customer when requested by that customer) or data collected from third party sources and use that data to create targeting segments to enable companies to better personalize advertising. If Demandbase shares such data, then except for online identifiers and IP address, it will only share any personal data collected in hashed form with authorized third parties. Business Activities. Demandbase shares information for its legitimate business needs, for example, in connection with, or during negotiations of, any merger, sale of assets, financing or acquisition of all or a portion of our business to another company or any other similar business, audit, or legal disclosure need. Demandbase may also share information with third party vendors (such as marketing, billing, or security service providers), consultants, and other service providers who work on our behalf and need access to your information to carry out their work for us and may use your information in connection with the provision of such services. Security. Demandbase may share information for security, fraud prevention, law and policy enforcement purposes, such as responding to legal matters or law enforcement requests or enforcing our policies and terms, protecting rights, property, and safety of individuals or other third parties. Marketing. Any information you volunteer for marketing purposes or otherwise, may be shared with the other third party or partner mentioned when you provide such information. With your consent. Additional ways that you may consent to have your data shared. Customers and other third parties may combine the data we share (including personal and demographic data) with additional data they have for their marketing and sales purposes. Demandbase offers a real-time technology, so data provided by the Demandbase Technology and the Demandbase ABM Platform, its services, any other technology, and other related data collected and derived insights may be shared with third parties in real-time. 4. DATA SECURITY Demandbase takes reasonable steps to safeguard the information we collect through the Demandbase Site and Partner Sites, such as employing measures like encryption or hashing, where appropriate. Demandbase takes reasonable and appropriate measures to prevent against loss, misuse and unauthorized access, disclosure, alteration and destruction. For example, Demandbase has undergone an independent third-party examination through a System and Organization Controls (SOC) Report for its services. Demandbase makes available a copy of its SOC 2 Report to current customers upon request. In the event you suspect a vulnerability, please share such details confidentially with Demandbase at security@demandbase.com. You should provide exact details of the suspected vulnerability so that Demandbase can verify and reproduce your results. Please do not publish or share any details of the suspected vulnerability with third parties or online except with Demandbase’s permission once resolved. Demandbase encourages you to choose a secure and secret password for your account. You should not disclose your Demandbase password to anyone. If you suspect that your password has been compromised, you must immediately notify Demandbase and change your password. Demandbase encourages you to learn about phishing and social engineering. You should never provide any personal information in response to any email you suspect comes from Demandbase. If you need to change or update your account information, we encourage you to log directly into the Demandbase Site to change, update or modify your personal information. If you believe that you received a request for personal information in an email potentially sent by Demandbase, please contact us immediately at security@demandbase.com. 5. CROSS BORDER TRANSFER Demandbase may transfer information that it processes to a jurisdiction with different privacy protections than yours. Demandbase processes and stores information in the United States and other countries. EU-US Privacy Shield and Swiss-US Privacy Shield. Demandbase, Inc. has certified under the EU-US Privacy Shield and the Swiss-US Privacy Shield and we employ standard contractual clauses. These frameworks help enable companies to legally transfer personal data from the European Union and Switzerland to the United States. For more information, including the type of information covered, see Demandbase, Inc.’s Privacy Shield Notice. To view our certification, please visit https://www.privacyshield.gov/list. 6. CONSUMER INFORMATION CHOICES AND OPTING-OUT OF PERSONALIZED ADS a. Marketing Emails Opt-Out In the event we send direct marketing emails to you, we will rely on the legitimate interests basis of processing and include an “unsubscribe” link at the bottom of all of our emails to allow you to object to Demandbase’s use of your personal information for this purpose. Click the link to unsubscribe and Demandbase will remove you from future emails within a reasonable amount of time. b. Interest-Based Advertising Opt-Out and Global Opt-Out Demandbase services are designed to make B2B advertising more relevant to its customers’ business needs. Opting-out of interest-based advertising won’t affect the number of ads that you see or allow you to opt-out of advertising; however, opting-out will make ads less relevant to you and your interests and allow you to opt-out of advertising from Demandbase. If you choose to opt-out, then you will no longer receive ads from Demandbase as long as the opt-out cookie is installed on your machine. When serving interest-based advertising to you, Demandbase includes the Digital Advertising Alliance’s (“DAA”) AdChoices icon within such ads. This icon generally appears as in one of the corners of the ad and may be accompanied by text such as “AdChoices.” You can click on the icon to learn more about the ad and to opt-out of receiving ads from Demandbase in the future. Demandbase adheres to the DAA’s Self-Regulatory Principles for Online Behavioral Advertising. To learn more about the DAA and the AdChoices Icon, and to opt-out of interest-based advertising delivered by other participating companies, please visit: DAA: www.aboutads.info/choices The DAA opt-out requires the ability to set an opt-out cookie in your browser. Your opt-out choices only apply to the particular browser and device from which you have opted-out (ex. work computer vs. personal computer) and only to the applicable advertising channel (you may still receive interest-based advertising in-app or email marketing if you opt-out via web browser cookies) or otherwise not via cookies. Please note that if you delete, block, or otherwise restrict cookies or change your cookie preferences, or if you use a different computer or Internet browser, you may need to renew your opt-out choice. Cookie-based opt-out preferences do not apply to the Demandbase Technology used to personalize web content to companies. c. Browser Based “Do Not Track” Some browsers have incorporated “Do Not Track” (DNT) features, Demandbase does not respond to DNT signals. d. Cookie Management For more details, refer to the Demandbase Cookie Policy. e. Choices for European Economic Area (“EEA”) Visitors Individuals located in some jurisdictions, including the EEA, have specific legal rights in relation to their personal data. Subject to the exemptions under law, you may have the right to request access to information, update, delete or correct the information. Under certain circumstances, you have the right to receive personal data that we store about you and transmit that information to another without hindrance from us, including requesting that we provide your information directly to another, i.e. a right to data portability. You may also request that we restrict or block the processing of your information. Where we previously obtained your consent, you have the right to withdraw your consent to the processing of your information. If you would like to exercise any of your rights, please email privacy@demandbase.com for further steps to do so. Demandbase will validate these requests and carry out the requests, if valid. If the request is not deemed valid, then Demandbase will share the reasons why it is not valid and your options for seeking resolution through a supervisory authority and through judicial remedy. These requests are typically free-of-charge; however, Demandbase may charge you an administrative fee in the event that the request is manifestly unfounded or excessive, such as multiple repetitive requests or additional copies. You have the right to lodge a complaint against us. To do so, contact the supervisory authority in your country of residence. f. Your California Privacy Rights Individuals located in California may contact Demandbase at privacy@demandbase.com with valid information sharing-disclosure requests. Once per calendar year, you may request a complete list of all personal information outlined under CA Civil Code section 1798.83 that is disclosed to third parties and the nature of that information. Demandbase will validate any requests received and for valid requests, share the categories information disclosed and the companies to which they were disclosed in the last year. This section provides additional details about the personal information we collect about California residents and the rights afforded to them under the California Consumer Privacy Act or “CCPA.” For more details about the personal information we collect, please see section 1 (“Data Collection by Demandbase”) above. We collect this information for the business and commercial purposes described in section 2 (“Data Use by Demandbase and Legal Bases for Processing Data for the EEA”) above. We share this information in accordance with section 3 (“Data Sharing by Demandbase”) above. Demandbase does not sell (as such term is defined in the CCPA) the personal information we collect (and will not sell it without providing a right to opt out). Please note that we use cookies for advertising purposes as further described in our Cookie Policy. Subject to certain limitations, the CCPA provides California residents the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights. California residents may make a request pursuant to their rights under the CCPA by contacting us at CCPA Request. We will verify your request using the information associated with your account, including email address. Government identification may be required. California residents can also designate an authorized agent to exercise these rights on their behalf. 7. NOT DIRECTED TO UNDER 16 Demandbase does not direct Demandbase Sites or services to children under 16 and does not knowingly collect information from children under 16. 8. CONTACT US AND HOW WE COMMUNICATE WITH YOU a. Contact Us If you have any questions about our privacy practices or this policy, please contact us at privacy@demandbase.com, or write us at: Demandbase, Inc. Attn: Privacy 680 Folsom Street #400 San Francisco, CA 94107 If you raise a concern regarding your data, we will take reasonable steps to investigate and attempt to resolve any complaints or disputes. To contact our Data Protection Officer, please email dpo@demandbase.com. Demandbase has also appointed an EU Representative to act on our behalf and serve as a direct contact for supervisory authorities and data subjects. To contact our EU Representative, please email: GDPRrepresentative@demandbase.com. b. How we will communicate with you If you have a business account with Demandbase, we will communicate with you through the business account contact details. For all others, if you provide us with contact information, we will reach out to you in accordance with provided details. 9. CHANGES We may amend this Privacy Policy from time to time by posting the amended terms on this privacy page of the Demandbase Sites, which will be effective as of the effective date stated on the top of this page. Demandbase will notify registered users of the Demandbase ABM Platform of material changes to this privacy policy. Past versions of the policy will be archived and available here.
